- tor-relays - lists.torproject.org

Lawsuit threat over (unlikely?) SYN flood
by Formless Networking 25 Feb '11

25 Feb '11

Just as a heads up, I got a curt, vague lawsuit threat the other day out of the blue. The guy claimed my node IP took down his (unmentioned) e-commerce sites for some unspecified period of time through a SYN flood. The sites that I could find associated with his email address appeared still up and functional. Since SYN floods can be spoofed, and since Tor nodes don't really have the resource amplification that typically makes them effective, I'm assuming it's probably just someone who forgot to take their meds for a while and/or who is just making things up to try to chill our tor node off line. Just in case, here is what I sent in response. If anyone else hears from this guy, feel free to copy and paste. ---------------------------- It seems very unlikely that what you pasted here is due to our Tor router (unless it has been compromised?). Our node is not capable of transmitting SYN packets on behalf of users fast enough to actually do damage. It is rather expensive for a tor client to generate this type of traffic, and a couple forms of protection mechanisms are built in to the tor router flow control that slow this down. We would be very surprised if this attack actually came through our node, and actually brought down any of your services. Unlike more direct attacks on your server at the application layer, SYN floods are possible to spoof. This packet could actually be coming from anywhere... However, in either case, this attack should be simple to block. You can prevent the entire Tor network (not just our router) from sending you traffic by using this exported IP list to generate firewall rules to drop SYN packets: https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=1.2.3.4&port=80 If this is in fact a SYN flood attack, they may just switch spoofed source IPs on you, though, so an IP block is probably not what you want. There are plenty of documents online that describe server parameters to help reduce the impact of this attack on your services, depending on your server OS. We recommend looking into them to better protect yourself and your customers. Thanks

3 2

setting up a bridge - troubleshooting
by Kathryn Cramer 22 Feb '11

22 Feb '11

I am trying to set up a Bridge on a Mac running OSX 10.5.8 and using a Trendnet Wireless Broadband router. UPnP is enabled. Clicking Test on the Vidalia Settings menu yields the message "Failed to add a port mapping." There is a menu on the router software entitled Gaming which is the only place I can find that allows setting of ports. I tried using that to configure the port forwarding needed by the router, but that didn't work. (It looks like this: http://screenshots.portforward.com/TRENDnet/TEW-631BRP/Gaming.htm ) It is described by the manufacturer as follows: "This option is used to open multiple ports or a range of ports in your router and redirect data through those ports to a single PC on your network. This feature allows you to enter ports in various formats including, Port Ranges (100-150), Individual Ports (80, 68, 888), or Mixed (1020-5000, 689)." Ideas?

4 5

New relay - hibernation issue?
by Bill 17 Feb '11

17 Feb '11

I've had a new non-exit relay ("Tor4Democracy") running for about six days, and today based on my daily usage limits: AccountingMax 880803840 AccountingStart day 21:00 it went into hibernation. I'm not sure if this is proper behaviour, but it didn't seem publish a descriptor during hibernation. When it woke up, it reset uptime = 0 and started publishing again. I've scoured the FAQs but haven't had any luck. Following the relay security suggestions, I haven't been logging. Before I start logging to see if it repeats, is there something I'm missing / misconfiguring? Thanks in advance, Bill

1 1